Privacy Policy

1. Operator and scope

合同会社Ｓｔｒａｔｕｍ　Ｆｌｏｗ (Stratum Flow, the Company) handles personal information concerning Tomopact accounts, workspaces, cases, notifications, billing, and inquiries under this policy. The corporate website's policy also applies to inquiries made solely through that website.

2. Information and purposes

Account information: email addresses, display names, authentication service user IDs, verification status, and authentication settings are used for registration, sign-in, identity checks, access control, and support. Firebase Authentication handles password authentication. Document versions, acceptance time, and displayed language are used to manage and record acceptance.

Shared information: workspace members and invitees, case participants, conditions, schedules, discussions, approvals, task history, and attachments are used for collaboration, permission-based display, history, storage accounting, recovery, and incident response. Anyone entering another person's information must verify their authority and any required consent to submit and share it.

Notification and integration information: preferences, email addresses, destination IDs for Slack, Teams, or other connections, integration credentials, and delivery results are used for invitations, approval requests, configured notifications, maintaining connections, and troubleshooting.

Billing information: Stripe customer, subscription, payment, and invoice identifiers, plans, subscription status, and billing contact details are used for billing, allowances, plan changes, cancellation, accounting, and legal obligations. Card details are processed through Stripe's payment interface and are not stored in Tomopact's case database.

Technical and inquiry information: access times, IP addresses, request and error logs, and inquiry content are used to prevent misuse, limit request rates, investigate incidents, and respond to inquiries. The Service has no feature that sells entered content for advertising or provides it for training generative AI models.

3. Sharing and external notifications

Workspace administrators, members, and case participants may view registered information and shared history according to their permissions. Workspace members and external case invitees have different access scopes. Review recipients and notification destinations before sharing.

Selected notification destinations receive information such as case names, activities, and related links. Email providers, external chat services, and recipients may retain delivered information; deleting it in Tomopact alone does not erase those copies.

The Company does not disclose personal data to third parties except for processing necessary for these purposes, user instructions or consent, legal requirements, or other permitted grounds.

4. Providers and processing outside Japan

We use Google Cloud and Firebase for authentication, data and attachment storage, hosting, backups, and logs; Stripe for payments and subscription management; and Resend for application email. If Slack, Microsoft Teams, or other connections are configured, their providers process information at those destinations.

The production case database and attachment storage are located in Tokyo, Japan. Web delivery, authentication, payments, email, support, and related operations may involve facilities or providers in the United States and other countries. Not all information is processed exclusively in Japan. We provide information and take measures required by law for international transfers; contact support for information on relevant safeguards and providers.

5. Retention, deletion, and shared history

Details are set out in the Data Management Policy. Ordinary deletion immediately stops normal access; recovery requests are normally accepted within 14 days. Recovery is unavailable after 30 days. Active data is physically deleted within 60 days and remaining backups expire within 90 days. Daily database backups are retained for up to 30 days and PITR data for up to 7 days.

Archiving retains content and history and is not deletion. Account deletion alone does not remove author names, responses, approvals, or task history from shared cases used by others. Acceptance records are included in account deletion processing. Payment and invoice records required by law are retained for the required periods; security access logs are retained for up to 90 days, with use restricted to their purposes.

6. Cookies and security

Cookies and browser storage are used for Firebase authentication sessions, language, theme, and email-link identification. During private access, an expiring access cookie is also used. Deleting or disabling these may prevent sign-in or retention of preferences.

Security measures include encrypted transport, authentication and authorization, restricted administrative permissions, management of secrets, backups, and monitoring for misuse. We select and manage providers and limit staff access to what is necessary for their duties. Contact us for an overview of safeguards, subject to limits needed to prevent misuse.

7. Requests concerning personal information

Contact support to request notification of purposes, disclosure, correction, addition, deletion, suspension of use, erasure, cessation of third-party disclosure, or disclosure of applicable third-party provision records concerning your retained personal data. Specify the account, information, and request. We verify identity or authority and respond under applicable law, explaining any refusal.

Do not send passwords or authentication tokens. Support will explain the required identity check. If a request entails a fee, we will explain its basis and amount before processing. Requests about information entered by others also require review of permissions and shared history.

8. Policy changes

Changes update this page's version and date. Material changes to purposes, sharing, or similar matters will be notified through the Service or registered email, with separate consent where required by law. Agreeing to the Terms and acknowledging this policy does not authorize optional advertising or substitute for consent separately required by law.

Operator and contact

合同会社Ｓｔｒａｔｕｍ　Ｆｌｏｗ (Stratum Flow, a Japanese limited liability company)
岩谷 草紀 — Representative Member
607 Palais Tachibana Ensoleille, 1-29-27 Mizudo-cho, Amagasaki, Hyogo 661-0026, Japan

support@stratum-flow.com